diff options
| -rw-r--r-- | configure.sh | 2 | ||||
| -rwxr-xr-x | ekusub.sh | 32 | ||||
| -rwxr-xr-x | gensignedcert.sh | 3 | ||||
| -rwxr-xr-x | inimodify.sh | 36 | ||||
| -rw-r--r-- | openssl.cnf | 1 | ||||
| -rwxr-xr-x | signcsr.sh | 4 |
6 files changed, 42 insertions, 36 deletions
diff --git a/configure.sh b/configure.sh index 54e9577..02043d8 100644 --- a/configure.sh +++ b/configure.sh @@ -11,8 +11,8 @@ export CN="Joe Rayhawk" # Common Name export E="jrayhawk+ssl@omgwallhack.org" # Email; used in certs and for From: and CC: in ./mailcert.sh usage export OPENSSL_CONFIG="openssl.cnf" # For advanced customization (not suggested) -#export EKU="clientAuth, serverAuth" # we try to dynamically determine this in signcsr.sh export EMAIL_DEFAULT_DOMAIN="omgwallhack.org" # ./mailcert.sh uses this as a user's domain if nothing more obvious is available +export EKU="" # "clientAuth, serverAuth" # we try to dynamically determine this in signcsr.sh if [ -e ./local.cfg ]; then . ./local.cfg # dash is finnicky about how paths for sourcing work diff --git a/ekusub.sh b/ekusub.sh deleted file mode 100755 index bf1546d..0000000 --- a/ekusub.sh +++ /dev/null @@ -1,32 +0,0 @@ -#!/bin/bash -# Dynamically substitutes extendedKeyUsage in usr_cert in an openssl config file -# ./ekusub.sh "clientAuth, serverAuth" -#requires bash 4.0 regexes - -set -e -[ -n "$1" ] || cat # pass through - -IFS=$'\n' -CA_STANZA=0 -EKU_MODIFIED=0 -while read line; do - if [[ "$line" =~ ^\ *\[\ *usr_cert\ *\] ]]; then - CA_STANZA=1 - echo "$line" - elif [ $CA_STANZA == 1 ] && [[ "$line" =~ ^\ *extendedKeyUsage\ *= ]]; then - echo -n "$line" - echo ", $1" - EKU_MODIFIED=1 - elif [ $CA_STANZA == 1 ] && [[ "$line" =~ ^\ *\[\ .+\ \] ]]; then - if [ $EKU_MODIFIED == 0 ]; then - echo "extendedKeyUsage = $1" - echo - EKU_MODIFIED=1 - fi - CA_STANZA=0 - echo "$line" - else - echo "$line" - fi - -done diff --git a/gensignedcert.sh b/gensignedcert.sh index b51f69b..a5a5368 100755 --- a/gensignedcert.sh +++ b/gensignedcert.sh @@ -25,7 +25,8 @@ mkdir -pv "$CA"/signed "$CA"/temp "$CA"/certs openssl req -config "$OPENSSL_CONFIG" -new -nodes -out "$CA"/temp/"$1".csr -keyout "$CA"/temp/"$1".key chmod 600 "$CA"/temp/"$1".key SERIAL=$(cat "$CA"/ca/"$CA".serial) -openssl ca -config <( ./ekusub.sh "serverAuth" < "$OPENSSL_CONFIG" ) -in "$CA"/temp/"$1".csr +EKU="serverAuth" +openssl ca -config "$OPENSSL_CONFIG" -in "$CA"/temp/"$1".csr if [ -e "$CA"/certs/"$SERIAL".pem ]; then # openssl lacks useful exit status codes, so we check to see if it actually did anything instead. mv -i "$CA"/temp/"$1".csr "$CA"/temp/"$1".key "$CA"/signed/ ln "$CA"/certs/"$SERIAL".pem "$CA"/signed/"$1".crt # so we can find the certificate by name as well as by serial diff --git a/inimodify.sh b/inimodify.sh new file mode 100755 index 0000000..939e47a --- /dev/null +++ b/inimodify.sh @@ -0,0 +1,36 @@ +#!/bin/bash +# Dynamically modifies openssl config file +# ./inimodify.sh [header] [variable] [value] < openssl.cnf +# ./inimodify.sh "usr_cert" "extendedKeyUsage" "clientAuth, serverAuth" < openssl.cnf +#requires bash 4.0 regexes + +set -x +set -e +[ -n "$1" ] && HEADER="$1" || exit 2 +[ -n "$2" ] && VARIABLE="$2" || exit 3 +[ -n "$3" ] && VALUE="$3" || exit 4 + +IFS=$'\n' +HEADER_STANZA=0 +VARIABLE_MODIFIED=0 +while read line; do + if [[ "$line" =~ ^\ *\[\ *"$HEADER"\ *\] ]]; then + HEADER_STANZA=1 + echo "$line" + elif [ "$HEADER_STANZA" == 1 ] && [[ "$line" =~ ^\ *"$VARIABLE"\ *= ]]; then + echo -n "$line" + echo ", $VALUE" + VARIABLE_MODIFIED=1 + elif [ "$HEADER_STANZA" == 1 ] && [[ "$line" =~ ^\ *\[\ .+\ \] ]]; then + if [ "$VARIABLE_MODIFIED" == 0 ]; then + echo "$VARIABLE = $VALUE" + echo + VARIABLE_MODIFIED=1 + fi + HEADER_STANZA=0 + echo "$line" + else + echo "$line" + fi + +done diff --git a/openssl.cnf b/openssl.cnf index 2521f88..2bee755 100644 --- a/openssl.cnf +++ b/openssl.cnf @@ -179,6 +179,7 @@ basicConstraints=CA:FALSE # This is typical in keyUsage for a client certificate. # keyUsage = nonRepudiation, digitalSignature, keyEncipherment +extendedKeyUsage = $ENV::EKU # This will be displayed in Netscape's comment listbox. nsComment = "OpenSSL Generated Certificate" @@ -32,7 +32,7 @@ SERIAL=$(cat "$CA"/ca/"$CA".serial) if grep ^SPKAC "$1"; then # SPKAC HTML5 <keygen> standard [ -n $EKU ] || EKU="clientAuth" # I don't think servers do SPKACs openssl spkac -in "$1" # print key size - openssl ca -config <( ./ekusub.sh "$EKU" < $OPENSSL_CONFIG ) -spkac "$1" -notext + openssl ca -config $OPENSSL_CONFIG -spkac "$1" -notext else # x509 CSR if ! [ -n "$EKU" ]; then [[ "$( openssl req -in $1 -subject -nameopt multiline | grep -E '^ +commonName += ' | head -n 1 )" =~ ^\ +commonName\ +=\ (.+)$ ]] @@ -48,7 +48,7 @@ else # x509 CSR fi fi openssl req -in "$1" -text # print key size - openssl ca -config <( ./ekusub.sh "$EKU" < "$OPENSSL_CONFIG" ) -in "$1" -notext + openssl ca -config "$OPENSSL_CONFIG" -in "$1" -notext fi if [ -e "$CA"/certs/"$SERIAL".pem ]; then # openssl lacks useful exit status codes, so we check to see if it actually did anything instead. |